Information Commissioner's Office 


Updated BCR communication following the EU-UK Trade and 
Co-operation Agreement (TCA) 


In November 2020, ICO issued an Information Note setting out its 
expectations for existing EU BCR Holders requiring a UK BCR post 1 January 
2021. 


The UK and EU have now successfully negotiated a Trade & Co-operation 
Agreement (“TCA”) and as part of the joint declaration, the EU is currently 
considering the UK’s adequacy position for the purpose of data transfers. 
With effect from 1 January 2021 and whilst the EU considers the UK’s 
adequacy, an adequacy bridge is in place. This period (the “Specified 
Period”) is initially in place for four months?. During this time, the UK will 
not be deemed to be a “third country” for the purpose of data transfers from 
the EEA to the UK allowing data to continue to flow from the EEA to the UK 
without the need for an alternative transfer tool to be put in place. 


The UK government has already determined that it considers all EU 27 and 
EEA member states to be adequate for the purposes of data protection, 
ensuring that data flows from the UK to the EU/EEA remain unaffected. 
Further, the UK has agreed to continue to align with the EU on existing 
adequacy decisions. 


This bridge only concerns data transfers from the EEA to the UK meaning 
that any transfers from the UK to any other third country will still require a 
valid transfer tool before such transfers can take place (such as an adequacy 
decision, SCCs, UK BCRs etc). We would also refer organisations to the 
recent EDPB publications dated 13 January 2021, which can be found at: 


edpb_informationnote 20201215 transferstoukaftertransitionperiod upda 
ted20210113 en.pdf (europa.eu) 


https://edpb.europa.eu/sites/edpb/files/files/filel/edpb statement 20201 
215 brexit_updated20210113 en.pdf 

Whilst we wait for an adequacy decision, for the bridge to continue any new 
UK adequacy regulations, standard contractual clauses or ICO approvals of 


international transfer mechanisms, must be put before the TCA’s oversight 
mechanisms. 


The position regarding existing EU BCR Holders (seeking a UK BCR) remains 
unchanged and unaffected by the adequacy bridge and remains as set out in 
our Information Note dated November 2020. This update provides further 


1 The Specified Period may be extended by a further maximum two months 
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clarification on how ICO will be handling UK BCR applications during the 
Specified Period. 

EU Binding Corporate Rules authorised under Article 26(2) of 


Directive 95/46/EC where ICO was the lead supervisory 
authority. 


Pre TCA position 


Holders of EU BCRs where ICO was the lead supervisory authority who 
wanted to continue with their EU BCR were required to identify an EEA 
supervisory authority to act as their new lead for their EU BCRs post end of 
the transition period. The EDPB information note dated July 2020 explained 
the measures to be taken. The note advised that if this was not done, the 
EU BCR would no longer be valid under EU law. 


TCA bridge position 


ICO is no longer a competent supervisory authority for the purpose of the EU 
BCR. Organisations that have not completed the transition are urged to 
make contact with their new proposed lead to ascertain the status of their EU 
BCR. If the proposed lead supervisory authority accepts that the EU BCRs 
are valid then those EU BCRs will continue to be a valid tool for transferring 
data from the EEA to the UK. 


Any organisation falling into this category may also need to take the steps 
set out below. 


Continuing transfers from the UK: 


EU Binding Corporate Rules authorised under Article 26(2) of 
Directive 95/46/EC where the Information Commissioner 
issued an authorisation. (This includes those where ICO was the 
lead supervisory authority and some where ICO was not the 
lead but still issued an authorisation). 


Pre TCA position 


Holders of EU BCRs for which the Information Commissioner issued an 
authorisation under Directive 95/46/EC are eligible for a UK BCR under 
paragraph 9, Part 3, Schedule 21 to the DPA 2018 (as amended from 1 
January 2021). Though eligible, certain steps must still be completed. 


Each such BCR holder needed to produce a UK version of their BCRs by 1 
January 2021 to incorporate the changes described in the specified 
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paragraph of Schedule 21 DPA. The UK version of the BCRs must be 
provided to ICO on or before the next annual update due date. 


ICO requires each relevant organisation to produce a separate UK BCR each 
for Controllers and for Processors if their current EU BCR is a dual BCR 
document. ICO also requires each relevant organisation to tell us: 


e they want a UK BCR; 
e they have produced the necessary documentation; and 
e confirm when we can expect to receive their complete UK BCR pack. 


If the amended documentation is not provided to ICO’s satisfaction, the 
Information Commissioner may revoke the UK BCR authorisation. 


TCA bridge position 


The requirement for a valid transfer tool (e.g. a UK BCR) is unaffected by the 
adequacy bridge. The UK GDPR and UK DPA 2018 as amended by the Privacy 
and Electronic Communications 2019 and 2020 are now in force from 1 
January 2021. ICO therefore still requires any organisation described above 
that is eligible for a UK BCR to complete the necessary steps, prepare their 
documentation and contact us. ICO will not be required to obtain any input 
or further approval from the Partnership Council in order to confirm UK BCR 
status as this falls within Art FINPROV 10A.6 TCA. 


EU Binding Corporate Rules authorised under Article 26(2) of 


Directive 95/46/EC where the ICO was not the lead supervisory 
authority and did not issue an authorisation. 


Pre TCA position 


Holders of EU BCRs for which ICO did not act as lead and did not issue an 
authorisation are also eligible for a UK BCR. However certain conditions must 
be met. 


These conditions are: 


e their entity established in the UK must notify ICO that they have an EU 
BCR and wish to have a UK BCR; 

e they must provide the name and contact details of their DPO or other 
relevant contact; and 

e they must supply such additional information ICO reasonably requires. 


The additional information ICO expects to receive includes a UK version of 
the BCRs incorporating the changes described in paragraph 9, Part 3, 
Schedule 21, the DPA 2018 (as amended from 1 January 2021) which are 
more clearly set out in the requirements table published by ICO in November 
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2020. ICO requires separate documentation for BCRs for Controllers and for 
Processors. The conditions should be satisfied as soon as possible and, in any 
event, before 30 June 2021, as no confirmation of UK BCR will be issued by 
Information Commissioner until they are. These BCR holders have until 30 
June 2021 at the latest to provide this information to ICO’s satisfaction or 
they will lose their eligibility for a UK BCR. 


Please contact BCR@ico.org.uk. 
TCA bridge position 
The conditions that must be satisfied are unaffected by the adequacy bridge. 


The UK GDPR and UK DPA 2018 as amended by the Privacy and Electronic 
Communications 2019 and 2020 are now in force from 1 January 2021. ICO 
will be assessing the documentation provided to us and will approve UK BCRs 
to this group of organisations upon receipt of satisfactory requested 
documentation by 30 June 2021. ICO will not be required to obtain any input 
or further approval from the Partnership Council in order to approve a UK 
BCR in these cases as this falls within Art FINPROV 10A.6 TCA and 7(a) TCA. 


In the meantime, and pending approval, ICO reminds these organisations to 
ensure they have a valid transfer tool in place prior to making any 
international transfers. 


EU Binding Corporate Rules approved under EU GDPR where 
the ICO was not the lead supervisory authority 


Pre TCA position: 


These BCRs are not covered by paragraph 9, Part 3, Schedule 21 to the DPA 
2018 (as amended from 1 January 2021). Holders of these EU BCRs must 
contact ICO as soon as possible if they require a UK BCR to discuss the 
process and ICO’s requirements. Please contact BCR@ico.org.uk. 


TCA interim position: 


As part of the negotiations, the UK Government has agreed with the 
Commission that this category of EU BCR holders can be considered for a UK 
BCR also without triggering the involvement of the Partnership Council. Again 
this is on the basis that these approvals fall within the alignment provision 
pursuant to Art.FINPROV 10A.6 and 7(a) & (b) TCA respectively. 
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What this means for new BCR applications: 


Organisations seeking a new UK BCR 


For organisations who have not been relying on a previously approved EU 
BCR, including those that are currently in the application process for EU 
BCRs, and that may now need a UK BCR. 


ICO have recently published updated UK BCR application forms and 
corresponding referential tables that set out the detail on what documents 
you will need to provide. Upon receipt ICO will review your application and 
liaise with you if any further information is required prior to approval. 


When ICO is satisfied with the requested documentation, and assuming the 
Bridge is still in place, ICO will engage with the Partnership Counsel pursuant 
to ART.FINPROV 10A.9 prior to issuing any approval of the UK BCR. 


Useful Links: 


rules/2618940/final- -uk-bcr-p-referential-table-v10.docx 


https://ico.org.uk/media/for-organisations/documents/2618639/binding- 
corporate-rules-at-the-end-of-the-transition-period-final-131120.pdf 


https://ico.org.uk/media/for-organisations/documents/2618638/uk-bcr- 
requirements-to-transition-table-final.docx 
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